Signing in with a passkey instead of a password
What a passkey is, how to set one up, why it only secures sign-in together with two-factor authentication, and what happens if you lose the device.
· 2 min de lecture
Ce guide existe en allemand et en anglais. Vous lisez la version anglaise.
A passkey is a key that stays on your device and that you release with a fingerprint, face recognition or a device PIN. It is never typed anywhere, which is why it cannot be phished. You set one up under Settings, Security.
Setting one up
- Open Settings and go to Security.
- In the passkey section, click Add passkey.
- Give it a name you will recognise the device by, the laptop or the phone.
- Confirm your device's prompt. The passkey then appears in the list.
What Login-capable means
A passkey can carry a Login-capable tag. It means the key lives on the device itself and gets offered to you at sign-in, without typing an email address first.
Without the tag the passkey still works, but only as a confirmation after signing in with a password. Older entries created before passkey sign-in existed do not carry it either, simply because nothing is known about them.
Why the two-factor note sits there
Below the list there is an amber note for as long as two-factor authentication is off. The reason is not a formality.
A passkey makes signing in convenient and secure, but on its own it does not stop somebody signing in with your password. The second factor is what forces every sign-in to be confirmed, whichever route it takes. Together they close the chain; a passkey alone is just a convenient link in it. Setting up two-factor authentication covers how to switch it on.
Losing a device
Passkeys usually sit in your system keychain and reappear on a new device once you sign in there with the same account. In that case there is nothing to do.
If the key only ever existed on the lost device, sign in with your password and second factor and remove the entry with Remove. The old key is then worthless. Take the same route when you pass a device on.
What happens to your password
It stays. A passkey is an additional way in, not a replacement that deletes the password. That is deliberate: until every device you use carries a passkey, you still need the other route.
Questions fréquentes
- Does a passkey replace my password?
- At sign-in, yes, if it is login-capable. It does not delete the password, which stays as a second route in.
- What does the Login-capable tag mean?
- That the passkey lives on your device and can be offered at sign-in directly, without you typing an email address first.
- Why is there a note about two-factor authentication?
- Because a passkey on its own does not force every sign-in to be confirmed. Only with two-factor authentication switched on does it become end-to-end protection.
- What happens if I lose my device?
- If the passkey is backed up in your keychain, it reappears on the replacement. Otherwise sign in with password and second factor and remove the old entry.
- Can I have several passkeys?
- Yes, one per device is the usual pattern. Each carries its own name so you know which one you are removing.